openEuler-SA-2026-2959

Synopsis:

fluidsynth security updateSummary:

An update for fluidsynth is now available for openEuler-22.03-LTS-SP4Description:

FluidSynth is a free software synthesizer. Its currently based on the SoundFont 2 specifications and supports real time MIDI effect controls. It can be used as a shared library for embedding in other applications, can play MIDI files and has a command line shell. Many other applications use FluidSynth for audio synthesis.

Security Fix(es):

A heap-based buffer overrun was discovered in fluidsynth's command handler. Sending a pitch_bend_range command to the handler with an out-of-bounds channel argument will attempt to write the provided value argument into heap memory. If the command handler is exposed via fluidsynth's TCP server (i.e. created via new_fluid_server() or via fluidsynth -s) an attacker may manipulate heap memory, causing denial of service or remote code execution.(CVE-2026-58264)Topic:

An update for fluidsynth is now available for openEuler-22.03-LTS-SP4.

openEuler Security has rated this update as having a security impact of critical. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.Severity:

CriticalAffected Component:

fluidsynth